stitch-vue-element-components
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (scripts/fetch-stitch.sh) to download assets and instructs the agent to use standard npm commands for setup and testing.
- [EXTERNAL_DOWNLOADS]: Design HTML and metadata are fetched from Google Cloud Storage URLs via the Stitch MCP tools.
- [INDIRECT_PROMPT_INJECTION]: The skill processes design data from external APIs. 1. Ingestion points: Stitch MCP tool output. 2. Boundary markers: None specified. 3. Capability inventory: File system operations, network requests, and package management. 4. Sanitization: Handled by architectural constraints and component mapping rules.
Audit Metadata